System and method for geography-based correlation of cellular and WLAN identifiers

ABSTRACT

Methods and systems for tracking mobile communication terminals based on their identifiers. The disclosed techniques identify cellular terminals and Wireless Local Area Network (WLAN) terminals that are likely to be carried by the same individual, or cellular and WLAN identifiers that belong to the same multi-mode terminal. A correlation system is connected to a cellular network and to a WLAN. The system receives location coordinates of cellular identifiers used by mobile terminals in the cellular network, and location coordinates of WLAN identifiers used by mobile terminals in the WLAN. Based on the location coordinates, the system is able to construct routes that are traversed by the terminals having the various cellular and WLAN identifiers. The system attempts to find correlations in time and space between the routes.

CROSS-REFERENCE TO RELATED APPLICATION

This application is a continuation of U.S. patent application Ser. No.14/167,062, filed Jan. 29, 2014, which is incorporated herein byreference in its entirety.

FIELD OF THE DISCLOSURE

The present disclosure relates generally to wireless communication, andparticularly to methods and systems for correlating cellular andWireless Local Area Network (WLAN) terminals.

BACKGROUND OF THE DISCLOSURE

Various techniques for tracking and locating mobile communicationterminals, such as cellular phones, are known in the art. For example,U.S. Patent Application Publication 2012/0015626, whose disclosure isincorporated herein by reference, describes Methods and systems fordetermining mobile communication terminals (mobiles) that have a commonuser, or that have a group of users in common. The methods and systemsexamine change-of-association events of mobiles operating in a network,and correlate the events to determine common mobiles, i.e., mobiles thathave the same or similar change-of-association events. The eventsdescribed are generated by the mobiles themselves automatically, byvirtue of the fact that the mobiles are operating in the network. Thereis thus no need for, and the embodiments described herein do notrequire, user intervention to generate the events.

SUMMARY OF THE DISCLOSURE

An embodiment that is described herein provides a method includingreceiving first location coordinates measured for a first identifierused for identification in a cellular communication network, andreceiving second location coordinates measured for one or more secondidentifiers used for identification in a Wireless Local Area Network(WLAN). A second identifier, whose second location coordinates traversea second geographical route, at least part of which is correlative intime and space with a corresponding part of a first geographical routetraversed by the first location coordinates, is found among the secondidentifiers. A correlation between the first identifier in the cellularcommunication network and the second identifier in the WLAN is actedupon.

In some embodiments, the first identifier used in the cellularcommunication network is associated with a target individual, and actingupon the correlation includes tracking the target individual by trackingthe second identifier in the WLAN. In an embodiment, finding the secondidentifier includes discarding a given second identifier upon detectingthat, in a given time interval, a location of the given secondidentifier differs from the location of the first identifier by morethan a predefined distance.

In some embodiments, finding the second identifier includes defining agroup of candidate second identifiers that are located in a vicinity ofthe first identifier at a given time, and selecting the secondidentifier from among the candidate second identifiers. Selecting thesecond identifier may include removing from the group the candidate oneor more second identifiers that are not located in the vicinity of thefirst identifier at one or more second times.

In an embodiment, the first identifier includes at least one identifiertype selected from a group of types consisting of an InternationalMobile Subscriber Identity (IMSI), a Mobile Station InternationalSubscriber Directory Number (MSISDN), an International Mobile EquipmentIdentity (IMEI) and a Temporary Mobile Subscriber Identity (TMSI). Inanother embodiment, the second identifier includes at least oneidentifier type selected from a group of types consisting of an InternetProtocol (IP) address and a Medium Access Control (MAC) address.

In yet another embodiment, receiving the second location coordinatesincludes receiving from the WLAN indications of one or more proberequest messages of WLAN terminals that are not connected to the WLAN.In still another embodiment, finding the second identifier includesidentifying that a single multi-mode communication terminal uses thefirst and second identifiers. In an embodiment, finding the secondidentifier includes identifying that a first communication terminal thatuses the first identifier and a second communication terminal that usesthe second identifier are both carried by a single individual.

There is additionally provided, in accordance with an embodiment that isdescribed herein, apparatus including a first interface, a secondinterface and a processor. The first interface is configured to receivefirst location coordinates measured for a first identifier used foridentification in a cellular communication network. The second interfaceis configured to receive second location coordinates measured for one ormore second identifiers used for identification in a Wireless Local AreaNetwork (WLAN). The processor is configured to find among the secondidentifiers a second identifier whose second location coordinatestraverse a second geographical route, at least part of which iscorrelative in time and space with a corresponding part of a firstgeographical route traversed by the first location coordinates, and toestablish a correlation between the first identifier in the cellularcommunication network and the second identifier in the WLAN.

The present disclosure will be more fully understood from the followingdetailed description of the embodiments thereof, taken together with thedrawings in which:

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram that schematically illustrates a system forcorrelating cellular and WLAN communication terminals, in accordancewith an embodiment that is described herein; and

FIG. 2 is a flow chart that schematically illustrates a method forcorrelating cellular and WLAN communication terminals, in accordancewith an embodiment that is described herein.

DETAILED DESCRIPTION OF EMBODIMENTS Overview

Tracking of mobile communication terminals, such as cellular phones, isan important surveillance tool in many anti-terrorist and crimeprevention applications. In many cases, however, it is difficult tocorrelate communication terminals with the individuals who carry them.For example, hostile users often take measures to prevent tracking oftheir mobile communication terminals.

Embodiments that are described herein provide improved methods andsystems for tracking mobile communication terminals based on theiridentifiers. The disclosed techniques identify cellular terminals andWireless Local Area Network (WLAN) terminals that are likely to becarried by the same individual, or cellular and WLAN identifiers thatbelong to the same multi-mode terminal.

In some embodiments, a correlation system is connected to a cellularnetwork and to a WLAN. The system receives location coordinates ofcellular identifiers used by mobile terminals in the cellular network,and location coordinates of WLAN identifiers used by mobile terminals inthe WLAN. Cellular identifiers may comprise, for example, InternationalMobile Subscriber Identities (IMSI), Mobile Station InternationalSubscriber Directory Numbers (MSISDN), International Mobile EquipmentIdentities (IMEI) or Temporary Mobile Subscriber Identities (TMSI). WLANidentifiers may comprise, for example, Internet Protocol (IP) or MediumAccess Control (MAC) addresses.

Based on the location coordinates, the system is able to constructroutes that are traversed by the terminals having the various cellularand WLAN identifiers. The system attempts to find correlations in timeand space between the routes. If a geographical correlation of this sortis found between a cellular identifier and a WLAN identifier, the systemconcludes that the two identifiers are likely to belong to the samecommunication terminal, or to separate terminals carried by the sameuser.

The collection of location coordinates of cellular and WLAN identifiersis typically performed in mass, whereas the correlation between theidentifiers is typically performed in a target-centric manner. In atypical flow, the system is provided with a cellular identifier of atarget individual, and attempts to find a WLAN identifier whose route iscorrelative in time and space with the route traversed by the cellularidentifier. (In the present context, the phrase “a route traversed by anidentifier” refers to a route traversed by a terminal having theidentifier, for the sake of brevity. Similarly, the term “the locationof an identifier” refers to the location of a terminal having theidentifier.)

In an example embodiment, the system searches for a matching WLANidentifier by progressively discarding candidate WLAN identifiers whosecorrelation with the cellular identifier is insufficient. For example,the system may begin the search with a group of initial candidate WLANidentifiers that are found in the vicinity of the cellular identifier ata certain time. The system then moves to a subsequent point along thecellular identifier's route, and retains only candidate WLAN identifiersthat are located in the vicinity of the cellular identifier at thesubsequent time, as well. The system continues to narrow down the listof candidate WLAN identifiers in this manner, until converging to asingle candidate WLAN identifier that is sufficiently correlative intime and space with the cellular identifier.

In some embodiments, the correlation process takes into account the factthat WLAN coverage is often far from continuous and has many uncoveredregions (“holes”). Moreover, WLAN operation may be turned off forcertain periods of time. Therefore, a candidate WLAN identifier thatcorrelates with a cellular identifier over parts of the route but ismissing from other parts of the route may well be the sought identifier.

Thus, it is typically sufficient to show correlation between a candidateWLAN identifier and a cellular identifier along parts of the route,provided that along the other parts of the route there are no WLANlocation events of the candidate WLAN identifiers. Preferably, thereshould be no other WLAN location events of any terminals in these areas.

Because of the sporadic nature of WLAN coverage and activity, negativecorrelations play a central role in the disclosed correlation processes.A negative correlation event occurs when a cellular identifier and aWLAN identifier are found at distant locations within a short timeinterval, such that travelling between the locations within this timeinterval is not feasible. Such a situation, even if detected only once,disqualifies any possible correlation between the two identifiers.

The correlations between cellular and WLAN identifiers are valuable forsubsequent tracking and information gathering tasks. Typically, WLANidentifiers are transmitted over the air much more frequently thancellular identifiers, and also provide higher spatial accuracy. As such,tracking of WLAN identifiers is potentially highly accurate. On theother hand, the association of WLAN identifiers with target users isoften unknown. Correlations between cellular identifiers can sometimesbe obtained from the cellular service providers, but they usually do nothave information regarding WLAN identifiers. By correlating a targetuser with a WLAN identifier through a known cellular identifier, it ispossible to track the target user using his or her WLAN identifier.

System Description

FIG. 1 is a block diagram that schematically illustrates a system 20 forcorrelating cellular and WLAN communication terminals, in accordancewith an embodiment that is described herein. System 20 may be used, forexample, by various government and law enforcement agencies in order totrack individuals 24, such as criminals or terrorists, by trackingmobile communication terminals 28 they carry.

Terminals 28 communicate with one or more cellular communicationnetworks 32, such as GSM or UMTS networks, and/or with one or moreWireless Local Area Networks (WLANs) 36. Although the example of FIG. 1shows a single cellular network and two WLANs, the disclosed techniquescan be used with any desired number of cellular networks and WLANs.

Some of terminals 28 may communicate with only one type of network,whereas other terminals comprise multi-mode terminals that communicateover both the cellular network and the WLAN. Terminals 28 may comprise,for example, cellular phones, wireless-enabled personal computingdevices, or any other suitable type of communication terminal.

Any terminal 28 that communicates with cellular network 32 is identifiesin network 32 using one or more cellular identifiers. Any terminal 28that communicates with WLAN 36 is identifies in network 36 using one ormore WLAN identifiers. Several examples of cellular and WLAN identifiersare given below. Generally, the cellular and WLAN identifiers maycomprise any suitable identifiers that are used for identifyingterminals 28 in the respective networks.

In the example of FIG. 1, system 20 comprises a cellular interface 40for connecting to cellular network 32, a WLAN interface 44 forconnecting to WLAN 36, and a correlation processor 48 that carries outthe methods described herein. Processor 48 receives via interface 40location coordinates measured for various cellular identifiers, andreceives via interface 44 location coordinates measured for various WLANidentifiers.

Note that the connection between the terminal and the network typicallydiffers between cellular systems and WLANs. In a cellular system, theterminal is typically connected to one of the available networks at anygiven time. A WLAN terminal, on the other hand, is very frequently notconnected to any WLAN. Nevertheless, even when not connected, the WLANterminal transmits ‘probe request’ messages periodically, searching forone of the WLAN access points it was previously connected to. The proberequests can be used for detecting the WLAN terminal's location. Thefrequency of location events also differs between cellular systems andWLANs: In a WLAN, location events typically occur less than a minuteapart. In a cellular network, on the other hand, location events mayoccur infrequently, e.g., at more than ten minute intervals or more.Additional details regarding probe requests can be found in the IEEE802.11 WLAN specifications.

Based on the location coordinates of the cellular and WLAN identifiers,processor 48 finds cellular and WLAN identifiers having correlativegeographical routes. Processor 48 outputs the correlations betweencellular and WLAN identifiers to a monitoring center 52, for display toan operator 56. Example methods for establishing such correlations aredescribed further below. Certain additional aspects of correlatingcellular and WLAN identifiers are addressed, for example, in IsraelPatent Application 217867, filed Jan. 31, 2012, which is assigned to theassignee of the present patent application and whose disclosure isincorporated herein by reference.

The configuration of system 20 shown in FIG. 1 is an exampleconfiguration, which is chosen purely for the sake of conceptualclarity. In alternative embodiments, any other suitable systemconfiguration can be used. For example, the functions of correlationprocessor 48 may be partitioned among any desired number of processors,e.g., servers or other computing platforms, or performed by a singleprocessor. The functions of correlation processor 48 may be implementedin software, in hardware, or using a combination of hardware andsoftware elements.

In some embodiments, processor 48 comprises a general-purpose computer,which is programmed in software to carry out the functions describedherein. The software may be downloaded to the computer in electronicform, over a network, for example, or it may, alternatively oradditionally, be provided and/or stored on non-transitory tangiblemedia, such as magnetic, optical, or electronic memory.

Geography-Based Correlation Between Cellular and WLAN Identifiers

The disclosed techniques are based on an underlying assumption that acellular identifier and a WLAN identifier found in the same vicinityduring the same time interval are likely to be associated with the sameindividual. The geographical vicinity usually takes into account thelimited accuracy of the location measurements. This accuracy istypically on the order of several hundred meters for a cellularidentifier and less than fifty meters for a WLAN identifiers, althoughany other suitable accuracy can also be used. The time intervaltypically takes into account the different occurrence frequencies oflocation events in the cellular network and in the WLAN, as explainedabove.

This time-space correlation, however, is susceptible to falsecorrelations, especially in dense environments that contain largenumbers of terminals. One way of increasing the confidence of thecorrelation is to repeat it over geographical routes traversed by theidentifiers rather than at a single point in space and time.

Negative correlation, on the other hand, can often be established usinga single event: A cellular identifier and a WLAN identifier found atdifferent locations (e.g., locations that differ by more than apredefined distance) within a given time interval cannot be associatedwith the same terminal, and are unlikely to be associated with the sameindividual.

Thus, in some embodiments, processor 48 of system 20 correlates cellularidentifiers with WLAN identifiers by finding similarities between thegeographical routes traversed by the terminals having the identifiers.The disclosed techniques are thus particularly suitable for scenarios inwhich WLAN 36 covers a large geographical area, which has a considerableoverlap with the coverage area of cellular network 32. For example, WLAN36 may comprise a public WLAN or a dedicated WLAN that is deployed forserving system 20. Nevertheless, the disclosed techniques can be used inany other suitable deployment scenario of networks 32 and 36.

FIG. 2 is a flow chart that schematically illustrates a method forcorrelating cellular and WLAN communication terminals, carried out bysystem 20, in accordance with an embodiment that is described herein.The method begins with correlation processor 48 receiving frommonitoring center 52 a cellular identifier that is associated with atarget individual, at a cellular identifier input step 60. The cellularidentifier may comprise, for example, an IMSI, TMSI, MSISDN or IMEI of acellular terminal belonging to the target individual.

Processor 48 obtains location coordinates of this cellular identifier,at a cellular coordinate input step 64. Typically, processor 48 obtainsthe location coordinates of the cellular identifier from cellularnetwork 32 via interface 40. The interface may receive information fromnetwork 32 in various ways, such as by connecting to one or more of thewire-line interfaces between switching nodes of network 32, or usingoff-the-air reception. The location coordinates are typically generatedas a result of location events that occur in the cellular network inresponse to various conditions, such as hand-off or change of LocationArea Code (LAC). Typically, each location coordinate is receivedtogether with a time stamp indicating the time at which the location wasmeasured.

Processor 48 obtains location coordinates of various WLAN identifiers,at a WLAN coordinate input step 68. As noted above, WLAN location eventscan also be received from WLAN terminals that are not connected to WLAN36, but are located in the vicinity of access points that belong to thisWLAN. Periodic ‘probe requests’ of such terminals may be received byWLAN 36 and obtained by processor 48.

The WLAN identifiers may comprise, for example, IP or MAC addresses. Inaddition to the WLAN identifier, each location coordinate is typicallyreceived together with a time stamp indicating the time at which thelocation was measured. Typically, processor 48 obtains the locationcoordinates of the WLAN identifiers from WLAN 36 via interface 44.

Interface 44 may receive information from WLAN 36 using any suitablewire-line or off-the-air connection. In some embodiments, interface 44comprises a self-contained system that locates WLAN terminals. Examplesystems of this sort are produced by AeroScout, Inc. (Redwood City,Calif.) and by Ekahau, Inc. (Reston, Va.). Certain aspects of extractingidentifiers from WLAN communication devices are addressed, for example,in U.S. Patent Application Publication 2011/0128127, whose disclosure isincorporated herein by reference.

Having acquired the location coordinates of the various WLANidentifiers, processor 48 begins a process of identifying a WLANidentifier that is likely to be associated with the same target user asthe cellular identifier received at step 60 above. This WLAN identifiermay belong to the same multi-mode terminal as the cellular terminal, orto a separate WLAN terminal carried by the same user.

At a cellular route construction step 72, processor 48 uses the locationcoordinates and time stamps received at step 64 to construct the routetraversed by the cellular terminal of the target individual. The routeis defined in both time and space, i.e., specifies the time at whicheach location coordinate was traversed.

At a WLAN identifier searching step 76, Processor 48 searches for a WLANidentifier whose route is correlative (in time and space) with the routeof the cellular identifier. In other words, processor 48 searches for aWLAN identifier that traversed similar location coordinates as thecellular identifier at similar times. Such a WLAN has a very highlikelihood of being associated with the same target individual.

As explained above, the WLAN coverage may be sporadic and discontinuous,and the WLAN terminals are not always turned on. As such, gaps in thelocation coordinates of the WLAN identifier may well exist along itsroute. In the correlation process of step 76, such gaps do notdisqualify a candidate WLAN identifier, and its correlation isestablished based on positive and negative correlations. Negativecorrelation is a particularly powerful means for disqualifyingcandidates. Both positive and negative correlations typically take intoaccount the characteristic location accuracies and occurrencefrequencies of location events in the cellular network and in the WLAN.

If a matching WLAN identifier is found, as checked at a checking step80, processor 48 outputs or acts upon the identified correlation, at anoutput step 84. For example, processor 48 may indicate the correlatedpair of cellular and WLAN identifiers to monitoring center 52. Themonitoring center may act upon the correlation in various ways. Forexample, the monitoring center may begin tracking the target individual(e.g., track the location and/or network activity of the targetindividual) using the WLAN identifier. If no matching WLAN identifier isfound, the method terminates at a termination step 88.

The flow of operations described in FIG. 2 is an example flow that ischosen purely for the sake of conceptual clarity. In alternativeembodiments, any other suitable flow can be used.

In some embodiments, processor 48 searches for the matching WLANidentifier by testing an initial group of candidate WLAN identifiers,and gradually ruling-out candidate WLAN identifiers whose correlationwith the cellular identifier is insufficient.

In an example embodiment, processor 48 begins the search of step 76 witha group of initial candidate WLAN identifiers that are found in thevicinity of the cellular identifier at a certain time. For eachcandidate WLAN identifier, processor 48 initially compares all of itslocation coordinates to those of the cellular identifier and attempts toestablish negative correlation. If a negative correlation is found, thecandidate WLAN identifier is immediately disqualified.

After this initial screening stage, processor 48 attempts to establishpositive correlations between the cellular identifier and the remainingWLAN identifiers. Processor 48 may terminate the search process, forexample, upon converging to a single remaining WLAN identifier, uponreaching a predefined confidence level (e.g., a predefined length ofroute that matches both types of identifiers), or when all the candidateWLAN identifiers are discarded.

It will be appreciated that the embodiments described above are cited byway of example, and that the present disclosure is not limited to whathas been particularly shown and described hereinabove. Rather, the scopeof the present disclosure includes both combinations andsub-combinations of the various features described hereinabove, as wellas variations and modifications thereof which would occur to personsskilled in the art upon reading the foregoing description and which arenot disclosed in the prior art. Documents incorporated by reference inthe present patent application are to be considered an integral part ofthe application except that to the extent any terms are defined in theseincorporated documents in a manner that conflicts with the definitionsmade explicitly or implicitly in the present specification, only thedefinitions in the present specification should be considered.

The invention claimed is:
 1. A system, comprising: a first interface,which is configured to receive first location coordinates measured for afirst identifier used for identification in a cellular communicationnetwork; a second interface, which is configured to receive secondlocation coordinates measured for one or more second identifiers usedfor identification in a Wireless Local Area Network (WLAN); and aprocessor, which is configured to find among the second identifiers asecond identifier whose second location coordinates traverse a secondgeographical route, at least part of which is correlative in time andspace with a corresponding part of a first geographical route traversedby the first location coordinates, and to establish a correlationbetween the first identifier in the cellular communication network andthe second identifier in the WLAN, wherein, a confidence measure of thecorrelation is increased by repeating the correlation over a furthergeographical routes in excess of the first and second geographicalroutes traversed by the first and second identifiers.
 2. The system ofclaim 1, further comprising communicating with one or more of a cellularcommunication network, a Global System for Mobile (GSM) network, aUniversal Mobile Telecommunications System (UMTS) network, and a WLAN.3. The system of claim 1, wherein the first and second identifiers areassociated with one or more terminals comprising one or more of acellular phone and a wireless-enabled personal computing device.
 4. Thesystem of claim 1, wherein the WLAN comprises a public WLAN or adedicated WLAN that is deployed for a serving system.
 5. The system ofclaim 1, wherein the interface receives the location coordinates fromthe cellular network by connecting to one or more wire-line interfacesbetween switching nodes of the cellular network.
 6. The system of claim1, wherein the interface receives the location coordinates from thecellular network by using an off-the-air reception.
 7. The system ofclaim 1, wherein the location coordinates are generated as a result ofone or more location events that occur in the cellular network inresponse to one or more of a hand-off and a change of Location Area Code(LAC).
 8. A method, comprising: receiving first location coordinatesmeasured for a first identifier used for identification in a cellularcommunication network; receiving second location coordinates measuredfor one or more second identifiers used for identification in a WirelessLocal Area Network (WLAN); finding among the second identifiers a secondidentifier whose second location coordinates traverse a secondgeographical route, at least part of which is correlative in time andspace with a corresponding part of a first geographical route traversedby the first location coordinates; and acting upon a correlation betweenthe first identifier in the cellular communication network and thesecond identifier in the WLAN, wherein, a confidence measure of thecorrelation is increased by repeating the correlation over a furthergeographical routes in excess of the first and second geographicalroutes traversed by the first and second identifiers.
 9. The method ofclaim 8, wherein the receiving of the first identifier used foridentification in a cellular communication network and the receiving ofthe second location coordinates measured for one or more secondidentifiers used for identification in the WLAN is performed as a groupin mass, and the correlation between the first identifier in thecellular communication network and the second identifier in the WLAN isperformed in a target-centric manner.
 10. The method of claim 8, furthercomprising communicating with one or more of a cellular communicationnetwork, a GSM network, a UMTS network, and a WLAN.
 11. The method ofclaim 8, wherein the first and second identifiers are associated withone or more terminals comprising one or more of a cellular phone and awireless-enabled personal computing device.
 12. The method of claim 8,wherein the WLAN comprises a public WLAN or a dedicated WLAN that isdeployed for a serving system.
 13. The method of claim 8, wherein aprocessor receives the location coordinates of the cellular identifierfrom the cellular network via an interface by connecting to one or morewire-line interfaces between switching nodes of the cellular network.14. The method of claim 8, wherein a processor receives the locationcoordinates of the cellular identifier from the cellular network via aninterface by using an off-the-air reception.
 15. The method of claim 8,wherein the location coordinates are generated as a result of one ormore location events that occur in the cellular network in response toone or more of a hand-off and a change of Location Area Code (LAC).